--- title: Additional Configurations Using KVP slug: device-management-apple/additional-configurations-using-kvp createdAt: 2026-10-06T07:47:38.084Z --- Key Value Pairs (KVP) are simple application settings that consist of a key (the name of the setting) and a value (the configuration to apply). Using Ivanti Mobile\@Work, organizations use KVPs to enable or disable features and adjust app behavior without requiring an app update. When Ivanti Mobile\@Work is operating on organization managed devices, it reads these KVP settings at start-up or during a check‑in. The app applies the updates immediately, ensuring that configuration changes are delivered quickly, consistently, and to the correct users. ## Configuring Ivanti Mobile\@Work App The Ivanti Mobile\@Work app supports KVPs to customize violation messages. You can manually configure the Ivanti Mobile\@Work app settings using Ivanti EPMM to customize application behavior as follows: **Procedure** 1. Log in to Ivanti EPMM admin portal. 2. Go to **Apps**>** Apps Catalog**. 3. Enter Ivanti Mobile\@Work in the **Search by Name** field. Optionally, you can enter a label in the **Type label to filter** field, select one of the options from **Source**, or select one of the **Platform** options in the **Filters** pane to search an app. 4. Select the Ivanti Mobile\@Work app. The **App Configurations** pane appears. 5. Click **Edit**. 6. Navigate to **Managed App Configurations** section to customize and prioritize app configurations based on app usage. 7. Click **Add+** to add app configuration. The **New App Configuration** pane appears. 8. Enter the name of the configuration in the **App Configuration Name** field. 9. Select a source in the **Source Type** field. 10. Upload a *.xml* file type. :::hint{type="info" indent="1"} Make sure that the file type is *.xml* and it must contain the Version and Bundle ID that denotes the KVP for the app. ::: 11. Click **Add**. 12. Select **Save** to successfully customize the app configuration. The updated KVPs apply to devices during the next check‑in. ## Adding Multiple KVPs Administrators can configure multiple KVPs for a managed iOS app by using app serial numbers, bundle identifiers, version details, or other metadata. :::hint{type="info"} This feature requires a separate license. Prior to using this feature, ensure your organization has purchased the required licenses. ::: They must upload a *.plist* file type in the Ivanti EPMM admin console to complete this configuration efficiently as follows: **Procedure** 1. Log in to Ivanti EPMM admin portal. 2. Go to **Policies & Configs**>** Configurations**. 3. Select **Add New** > **Apple** > **iOS / macOS / tvOS** > **Managed App Config**. The **New Managed App Config Setting** pane appears. 4. Enter the name of the configuration in the **Name** field. 5. Enter the description of the configuration in the **Description** field. 6. Enter the bundle ID of the app in the **BundleID** field. 7. Browse and upload a *.plist* file type in the **File** field. :::hint{type="info" indent="1"} The uploaded file must have a *.plist* extension. If you have manually created the file (for example, in a text editor), make sure that the extension is changed from *.txt* to *.plist* before uploading. ::: 8. Select **Save**. 9. Select **Apply Labels** to distribute the configuration to applicable groups or devices. For more information, see "Applying configurations to labels". ## Single App Mode Activation During Device Registration This feature allows administrators to use KVPs during device registration to automatically launch Ivanti Mobile\@Work in Single App Mode (SAM). When the device starts enrollment, the configured KVPs trigger Ivanti Mobile\@Work to open immediately. During this process, the user sees the following message: **Please wait while your device is being configured**. To enable this behavior, you must install the SAM configuration and explicitly target it to Ivanti Mobile\@Work before or during the registration workflow. After the device completes enrollment, it automatically exits SAM. The device is then released to the user for normal operation, ensuring a secure setup without limiting use after registration. This capability provides a controlled and secure registration flow for supervised devices. ### Setting Up Zero-Touch Activation To enable Zero-Touch activation for Ivanti Mobile\@Work, perform the following steps: **Procedure** 1. Set up a Label that includes only devices where Client Registered = No. 2. Create a Single App Mode (SAM) configuration for the Ivanti Mobile\@Work application and assign it to the Label you have created. 3. Add the zero\_touch\_activation KVP to the Ivanti Mobile\@Work application configuration and target the same Label. The following table displays the KVP configuration for Zero-Touch activation: | Key | Value | Type | Description | | ----------------------- | ----- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | zero\_touch\_activation | True | Boolean | When the value is set to true, the Ivanti Mobile\@Work app recognizes that it is running in Single App Mode (SAM) through the SAM configuration. The SAM configuration launches the Ivanti Mobile\@Work app, while this value acts as an additional setting that enables the app to function correctly in SAM mode. After successful enrollment, the device exits Single App Mode and becomes available to the end user for normal use. | ## Disable Screenshot Protection on SAML Authentication Screen The Ivanti Mobile\@Work app includes built‑in screenshot protection to enhance security during device registration. By default, the registration screens that use SAML authentication blocks the following: - Screenshots - Screen recordings - Screen sharing This protection ensures that sensitive authentication data such as usernames, passwords, and SAML based login content cannot be captured or shared without authorization. Administrators can disable screenshot protection on managed devices by using a KVP configuration. When this configuration is applied, the Ivanti Mobile\@Work app allows screenshots and screen recordings only on the SAML authentication screen while maintaining all other security protections across the app. To disable screenshot protection for SAML authentication screen, apply the following KVP to Ivanti Mobile\@Work app configuration in Ivanti EPMM: | Key | Value | Description | | -------------------------------- | ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SCREENSHOT\_PROTECTION\_DISABLED | True | Disables screenshot, screen recording, and screen sharing protection on SAML authentication screen. When you omit this setting or set it to False, the protection remains enabled by default. | ## Configure Default Browser and Email KVPs Using Managed App Configuration KVPs enable administrators to configure which browser and email app the Ivanti Mobile\@Work uses when opening web links and composing emails via Managed App Configuration. As an administrator, you can use Managed App Configuration KVPs to control how links are handled within the **Support** tab: | Key | Values | Type | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | default\_browser | Safari
Edge
Chrome
Firefox
Brave
Opera
Web\@work
DuckDuckGo | String | The Ivanti Mobile\@Work uses a browser to open web links in the **Support** tab.
http or https links are redirected to the configured browser scheme.
If a default browser is not configured, it uses the device's default browser. | | Allow\_browser\_fallback | True
False | Boolean | Behavior when default browser is not installed:
- **True**: Falls back to default system browser.
- **False**: Link not opened, user sees “\ not installed” alert.
- Default if not configured: True | | restrict\_log\_sharing\_to\_email | True
False | Boolean | Whether log or support sharing is restricted to email only (using `default_email`).
Auto-attaching logs works with Email+ and Native mail works with `allow_email_fallback`.
- **True**: Sharing to email only.
- **False**: Standard sharing options available.
- Default if not configured: False | | default\_email | Native Mail
Outlook
Gmail
Yahoo
Citrix Mail
Email+
Spark
Protonmail | String | Ivanti Mobile\@Work uses one of the email apps to compose mails from mailto links in **Support** tab.
mailto is transformed into the user's composing URL.
Default if not configured: Default mail application.
Dual role in link resolution and log sharing when `default_email` app is not installed. | | Allow\_email\_fallback | True
False | Boolean | Behavior when default email is not installed:
- **True**: Email composition falls back to the default mail application if the configured email app is not installed, and log sharing can use an alternate delivery method.
- **False**: Email composition is blocked, and users see a **Not Installed** alert if the configured email client is unavailable. Log-sharing restrictions are enforced with no fallback option.
- Default if not configured: True (fallback behavior is enabled). | ## KVPs to Customize Policy Violation Messages The Key Value Pairs (KVP) enable administrators to customize the messages sent to end users when policy violations occur. The KVPs for customization describe the available KVPs and violation types that administrators can use to modify Ivanti Mobile\@Work app behavior. :::hint{type="info"} The violation types are not mutually exclusive. When multiple violations occur, the Ivanti Mobile\@Work app displays a list of all applicable messages. ::: The KVPs in the following table define how the app behaves, including providing detailed notifications to device users and exporting contacts from Ivanti Mobile\@Work: Table: KVPs with Default Messages | Key Value Pairs (KVP) | Default Messages | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | • Your device has been compromised because it has been jailbroken. Please properly return your device to a non-jailbroken state or contact your administrator for help resolving this issue. | | | • Your device is running an unsupported, older version of iOS. Please upgrade to the latest version of iOS or contact your administrator for help resolving this issue. | | | • Your iOS device is not supported. Please contact your administrator for help resolving this issue. | | | • Corporate access has been disabled for data protection. Please contact your administrator for help resolving this issue. | | | • Corporate access has been disabled as the policy is out of date. Please contact your administrator for help resolving this issue. | | | • Your iOS device is out of contact. Please contact your administrator for help resolving this issue. | | | • Your device is missing apps that are required and/or it has apps that aren’t allowed. Please add/remove necessary apps or contact your administrator for help resolving this issue. | | | • You have too many mobile devices configured to access corporate email. Please contact your administrator for help resolving this issue. | | | • Your device is auto blocked. Please contact your administrator for help resolving this issue. | | | • Your administrator has manually disconnected your device from corporate access. Please contact your administrator for help resolving this issue. | | | • Corporate access has been disabled for issues with exchange. Please contact your administrator for help resolving this issue. | | | • Your device is out of compliance because MDM capability has been deactivated. Please re-enroll your device, or contact your administrator for help resolving this issue. | | | | | | • Please contact your administrator about any loss of corporate access issues. | | | • Corporate access has been disabled for an unspecified reason. Please contact your administrator for help resolving this issue. | | | Your device is out of compliance for the following reason(s): | ```bash compliance.message.COMPROMISED ``` ```bash compliance.message.OS_VERSION ``` ```bash compliance.message.HW_VERSION ``` ```bash compliance.message.DATA_PROTECTION ``` ```bash compliance.message.POLICY_OUT_OF_DATE ``` ```bash compliance.message.DEVICE_OUT_OF_CONTACT ``` ```bash compliance.message.APP_CONTROL ``` ```bash compliance.message.PER_MAILBOX_LIMIT ``` ```bash compliance.message.AUTO_BLOCK ``` ```bash compliance.message.MANUAL ``` ```bash compliance.message.EXCHANGE ``` ```bash compliance.message.DEVICE_ADMIN_DEACTIVATE ``` ```bash compliance.message.INTERNATIONAL_ROAMING ``` ```bash compliance.message.REASON_UNKNOWN ``` ```bash compliance.message.generic ``` ```bash compliance.message.header ``` :::hint{type="info"} If blocked reasons list does not contain any value that has a mapped message but contains at least one violation that does not have mapped message then there will be a default message: “• Corporate access has been disabled for an unspecified reason. Please contact your administrator for help resolving this issue." ::: :::hint{type="info"} If there is at least one violation message in the messages list then there will be a header for the messages list: “Your device is out of compliance for the following reason(s):” ::: :::hint{type="info"} If you do not want to change a default message, do not provide a KVP for it; only include KVPs for the messages you intend to modify. :::